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It is hereby agreed by the Accused, Defense Counsel, and Trial Counsel, that if SA 
Ronald Rock were present to testify during the merits and pre-sentencing phases of this court- 
martial, he would testify substantially as follows: 

1. I currently work as a Special Agent with the U.S. Department of State (DoS), Diplomatic 
Security Service (DSS). Prior to becoming a Special Agent with the DSS, I served as a Sergeant 
on the DSS, Uniformed Division from 1999-2001. There, I provided oversight for over fifty 
uniformed officers at nine DoS annexes in Washington, D.C. and Maryland. I graduated from 
the DSS, Basic Special Agent Class in July 2002 where I won the DSS Director's award as the 
top graduate. Since then, I have served in the DSS Washington Field Office (2002-2004); the 
Secretary of State's Protective Detail (2004-2006); U.S. Embassy Bogota (Colombia) (2006- 
2008); the National Defense Intelligence College (2008-2009); the Special Investigations 
Division (2009-2012). During my three years in the Special Investigations Division (SID), 
where I was promoted to Acting Branch Chief in charge of supervising seven other special 
agents, my portfolio included the responsibility for investigating cases of criminal and 
administrative misconduct by DoS employees, their family members and contractors, as well as 
employees from other agencies under Chief of Mission authority at U.S. Consulates and 
Embassies worldwide. I led the investigative effort for DSS on several high profile cases 
involving the unauthorized disclosure of DoS classified information. Additionally, I drafted the 
standard operating procedure by which SID currently investigates leaks of DoS classified 
information. 

2. I currently work at the U.S. Consulate in Mazar-e Sharif, Regional Command North, 
Afghanistan. There, my team and I are responsible for the safety and security of all American 
diplomats who travel through the nine provinces comprising Northern Afghanistan. 

3. In this case, I was involved with the coordination for evidence collection, as well as the actual 
collection of evidence at the DoS. Specifically, I coordinated with DoS Deputy Chief 
Information Officer (DCIO) Charlie Wisecarver to obtain a CD containing Department of State 
SIPRNET firewall log traffic for IP addresses 22.225.41.40 and 22.225.41.22. On 14 October 
2010, 1 visited DCIO Wisecarver in Washington, D.C. and collected a disk containing the 
firewall logs from the DoS classified system. The disk was a silver CD bearing the markings 
"Wikileaks DoS Firewall Logs 13 Oct 10." It bore a US Government SECRET sticker. This 
disk was important to our investigation as the logs showed connections between the DoS NCD 
database and the IP addresses of the SIPRNET machines assigned to PFC Manning. 
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4. On 15 October 2010, 1 signed the CD marked with the words "Wikileaks DoS Firewall Logs 
13 October 2010" over to SA John Wilbur. I handled this evidence consistent with procedures as 
I have been trained. When signing over the evidence, I used a Department of the Army Evidence 
Property Document (DA Form 4137) with the label DN 151-10 and this CD was item 1 (BATES 
numbers: 004 11151 -004 1 1 1 52). While in possession of this evidence, I maintained positive 
control. I did not alter the information on the CD. I have no reason to believe this evidence was 
damaged or contaminated in any way. I did not touch this evidence again. 

5. Prosecution Exhibit 68 for Identification is this CD (DN 151-10, Item 1). 
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